forgot-password mails don't URL-encode the mail

Forgot-password mails currently use the simple code:

#set($reseturl = "${reseturl}?q=${uemail}&vk=${valkey}")

which fails hard if your email address contains slightly fancy characters, in particular if it contains the + sign.

The mail parameter should be URL-encoded.